Scribd
Upload
753 views

Wireshark Lab: TCP v8.0

The document summarizes the results of a Wireshark lab analyzing a TCP connection between a client computer and gaia.cs.umass.edu. Key details include: 1) The client computer used IP address 10.228.223.79 and source port 52617 to transfer a file to gaia.cs.umass.edu at IP address 128.119.245.12 on port 80. 2) The initial SYN segment from the client had a sequence number of 0 and the SYNACK from the server had a sequence number of 0 and acknowledgement number of 1. 3) The throughput of the TCP connection was calculated to be 23413.77 bytes per second based

Uploaded by

Truonganh Bao
Copyright
© © All Rights Reserved
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
753 views

Wireshark Lab: TCP v8.0

The document summarizes the results of a Wireshark lab analyzing a TCP connection between a client computer and gaia.cs.umass.edu. Key details include: 1) The client computer used IP address 10.228.223.79 and source port 52617 to transfer a file to gaia.cs.umass.edu at IP address 128.119.245.12 on port 80. 2) The initial SYN segment from the client had a sequence number of 0 and the SYNACK from the server had a sequence number of 0 and acknowledgement number of 1. 3) The throughput of the TCP connection was calculated to be 23413.77 bytes per second based

Uploaded by

Truonganh Bao
Copyright
© © All Rights Reserved
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
You are on page 1/ 11

Tên:Trương Anh Bảo

MSSV:1811550

Wireshark Lab: TCP v8.0

1. What is the IP address and TCP port number used by the client computer (source) that is
transferring the file to gaia.cs.umass.edu? To answer this question, it’s probably easiest to select
an HTTP message and explore the details of the TCP packet used to carry this HTTP message,
using the “details of the selected packet header window” (refer to Figure 2 in the “Getting
Started with Wireshark” Lab if you’re uncertain about the Wireshark windows.

Answer: The source IP address was 192.168.1.102 using source port 1161.
2. What is the IP address of gaia.cs.umass.edu? On what port number is it sending and receiving
TCP segments for this connection?

Answer: The destination IP address is 128.119.245.12 receiving on port 80

3. What is the IP address and TCP port number used by your client computer (source) to transfer
the file to gaia.cs.umass.edu?

Answer: The source IP address was 10.228.223.79 using source port 52617.
4. What is the sequence number of the TCP SYN segment that is used to initiate the TCP
connection between the client computer and gaia.cs.umass.edu? What is it in the segment that
identifies the segment as a SYN segment?
Answer: The sequence number of the segment used to initiate the TCP connection is 0. We can
see that the message contains a SYN flag indicating that it is a SYN segment.

5. What is the sequence number of the SYNACK segment sent by gaia.cs.umass.edu to the client
computer in reply to the SYN? What is the value of the Acknowledgement field in the SYNACK
segment? How did gaia.cs.umass.edu determine that value? What is it in the segment that
identifies the segment as a SYNACK segment?

Answer: The sequence number of the SYNACK segment is 0.


The value of the acknowledgement field is 1. This value is determined by the initial sequence
number +1.
The message carries flags that show it to be a SYN ACK message.

6. What is the sequence number of the TCP segment containing the HTTP POST command? Note
that in order to find the POST command, you’ll need to dig into the packet content field at the
bottom of the Wireshark window, looking for a segment with a “POST” within its DATA field.

Answer: The sequence number of the TCP segment containing the HTTP Post Command is
164041.
7. Consider the TCP segment containing the HTTP POST as the first segment in the TCP connection.
What are the sequence numbers of the first six segments in the TCP connection (including the
segment containing the HTTP POST)? At what time was each segment sent? When was the ACK
for each segment received? Given the difference between when each TCP segment was sent,
and when its acknowledgement was received, what is the RTT value for each of the six
segments? What is the EstimatedRTT value (see Section 3.5.3, page 242 in text) after the receipt
of each ACK? Assume that the value of the EstimatedRTT is equal to the measured RTT for the
first segment, and then is computed using the EstimatedRTT equation on page 242 for all
subsequent segments.

Answer: First six segments: 4, 5, 7, 8, 10, 11


segmentSegment numberTime sentAcknowledgement ReceivedRTTEstimated RTT
1 1 .026 .054 .028 .028
2 566 .042 .077 .035 .035
3 2026 .054 .124 .070 .70
4 3486 .055 .169 .114 .114
5 4946 .077 .217 .140 .140
6 6406 .078 .268 .190 .190
8. What is the length of each of the first six TCP segments?
Segment 1 = 565 bytes
Segment 2 = 1460 bytes
Segment 3 = 1460 bytes
Segment 4 = 1460 bytes
Segment 5 = 1460 bytes
Segment 6 = 1460 bytes

9. What is the minimum amount of available buffer space advertised at the received for the entire
trace? Does the lack of receiver buffer space ever throttle the sender?

Answer: The minimum amount of available buffer space is advertised as (Calculated window
size): 5840 bytes. The lack of receiver buffer space does not ever throttle the sender.
10. Are there any retransmitted segments in the trace file? What did you check for (in the trace) in
order to answer this question?

Answer: There are no retransmitted segments. To check this, I looked for any repeating
segment numbers.
11. How much data does the receiver typically acknowledge in an ACK? Can you identify cases
where the receiver is ACKing every other received segment (see Table 3.2 on page 250 in the
text).

Answer: The receiver typically acknowledges 1460 bytes in an ack. If the data is doubled
then that segement is acking every other
12. What is the throughput (bytes transferred per unit time) for the TCP connection? Explain how
you calculated this value.

Answer: The file is 177851 bytes dive that by the total time 7.596 seconds and average
throughput is  23413.77 bytes per second
13. Use the Time-Sequence-Graph(Stevens) plotting tool to view the sequence number versus time
plot of segments being sent from the client to the gaia.cs.umass.edu server. Can you identify
where TCP’s slowstart phase begins and ends, and where congestion avoidance takes over?
Comment on ways in which the measured data differs from the idealized behavior of TCP that
we’ve studied in the text.

Answer: The slowstart phase begins at about zero and ends at about .15 seconds in
according to the graph then congestion takes over. The measured data is only using a
fraction of the window size instead of the idealized 1/3 to a half.

You might also like